Self-hosting

Self-hosting the Flockdeck relay

Remote access normally goes through the shared relay at remote.flockdeck.ai: your desktop dials out to it, and your phone or laptop reaches your desktop through it. That relay is operated by Flockdeck and decrypts traffic to route it, so it is not end-to-end encrypted — see Security and privacy.

For a company whose rules don't allow a third party to decrypt developers' terminal traffic, the relay can instead be run on your own infrastructure. That's Flockdeck Enterprise: a licensed, self-hosted relay, with single sign-on and support. It's announced on flockdeck.ai as coming soon — it isn't generally available yet, and single sign-on isn't built into the relay's main branch yet either.

This section documents the relay as it exists and runs today, for a platform or ops team evaluating what self-hosting will involve: how it's deployed, how it's configured, what it needs, and how a desktop points at it instead of the shared one. Everything here is accurate to the relay's current behaviour; nothing in it depends on Enterprise, SSO or licensing existing yet. When you're ready to run this in production, get in touch through flockdeck.ai for access and support.

What the relay does

The relay is a single Go program. A desktop running Flockdeck connects out to it over a WebSocket and keeps that connection open — nothing has to be opened on the desktop's own network. A browser (your phone, tablet or another computer) connects to the relay too, and the relay proxies its requests down the desktop's tunnel to the copy of Flockdeck running there. No ports are opened on the desktop's router, and no VPN is involved.

Everything else in this section assumes you're comfortable operating a small stateful Go service: a binary or a container, a place to keep its data, and a certificate.

What's on the following pages

• Requirements — what the relay needs to run: ports, TLS, DNS, storage.
• Deploying the relay — running it as a binary or a container, behind a reverse proxy, with your own certificate or with Flockdeck's built-in ACME support.
• Configuration — every flag and environment variable, in one table.
• Storage and data — the embedded database and the MySQL alternative.
• Admin and invites — the local admin API, inviting desktops, and usage stats.
• Connecting desktops — pointing Flockdeck at your relay instead of the shared one.
• Security and privacy — what the relay can see, and what it can't.
• Upgrading — keeping a self-hosted relay current.
• Troubleshooting — the usual ways a first deploy goes wrong.